Graph neural networks (GNNs) have achieved tremendous success in the task of graph classification and its diverse downstream real-world applications. Despite the huge success in learning graph representations, current GNN models have demonstrated their vulnerability to potentially existent adversarial examples on graph-structured data. Existing approaches are either limited to structure attacks or restricted to local information, urging for the design of a more general attack framework on graph classification, which faces significant challenges due to the complexity of generating local-node-level adversarial examples using the global-graph-level information. To address this "global-to-local" attack challenge, we present a novel and general framework to generate adversarial examples via manipulating graph structure and node features. Specifically, we make use of Graph Class Activation Mapping and its variant to produce node-level importance corresponding to the graph classification task. Then through a heuristic design of algorithms, we can perform both feature and structure attacks under unnoticeable perturbation budgets with the help of both node-level and subgraph-level importance. Experiments towards attacking four state-of-the-art graph classification models on six real-world benchmarks verify the flexibility and effectiveness of our framework.

翻译：图神经网络（GNN）在图分类任务及其多样化的下游实际应用中取得了巨大成功。尽管在图表示学习方面取得了重大进展，当前GNN模型已展现出其对图结构数据上潜在对抗样本的脆弱性。现有方法要么局限于结构攻击，要么受限于局部信息，这迫切需要在图分类任务上设计更具通用性的攻击框架，而由于利用全局图级信息生成局部节点级对抗样本的复杂性，这一任务面临重大挑战。为应对这一"全局到局部"的攻击挑战，我们提出了一种新颖且通用的框架，通过操控图结构和节点特征来生成对抗样本。具体而言，我们利用图类激活映射及其变体，生成与图分类任务对应的节点级重要性。随后通过启发式算法设计，在节点级和子图级重要性的辅助下，我们能够在不可察觉的扰动预算内同时执行特征攻击和结构攻击。针对六个真实世界基准数据集上四种最先进的图分类模型的攻击实验，验证了我们框架的灵活性和有效性。